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CERTIFICATE OF MArLING 

I hereby certify that this correspondence is being deposited with the 
United States Postal Service as First Class Mail in an envelope 
addressed to: Assistant Commissioner for Patents,/5^^ash^gton, DC 
20231 onOfiiober 7 ,2001. 

Signed: 



FOURTH REOUEST FOR CORRE 



Assistant Commissioner for Patents 
Office of Initial Patent Examination 
Customer Service Center 

Washington, D.C. 20231 



Sir: 




o 
o 



Enclosed is a copy of the Corrected Filing Receipt for the above-identified patent 
application. Also enclosed with this request is a copy of the page 1 of the above-referenced 
patent application showing the Cross Reference to Related Applications as filed on August 30, 
2000. Please reprint the Filing Receipt as follows and mail the corrected copy to the 
undersigned. 



Change the Continuing Data as Claimed by Applicant "THIS APPLN CLAIMS 
BENEFIT OF 60/151,531 08/30/1999" to - "THIS APPLN CLAIMS BENEFIT OF 60/151,531 
08/30/1999 AND 09/615,967 07/14/2000" --. 



Attorney Docket No. RECOP013 



Since this is a Patent Office typographical error, no fee should be due. However, the 
Commissioner is authorized to charge any fees that may be due to Deposit Account 50-0685 
(Order No. RECOP013). 



Respectfully submitted, 




Jusan C. Yi 
Reg. No. 39,883 




VAN PELT & YI LLP 
4906 El Camino Real 
Suite 205 

Los Altos, CA 94022 
(650) 903-3500 
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SYSTEM AND METHOD FOR USING LOGIN CORRELATIONS TO 

DETECT INTRUSIONS 



^ O rn 

CROSS REFERENCE TO RELATED APPLICATIONS i. ^ O 

This application claims priority to U.S. Provisional Patent Application No. S 

^ % O 

5 60/1 5 1 ,53 1 entitled "SYSTEM AND METHOD FOR PROVIDING COMPUTER ^ 

S 

SECURITY" filed August 30, 1999, which is incorporated herein by reference for all 
purposes, and to U.S. Patent Application No. 09/615,697 entitled "SYSTEM AND 
METHOD FOR COMPUTER SECURITY" filed July 14, 2000, which is incorporated 
herein by reference for all purposes. 

10 This application is related to co-pending U.S. Patent Application No. 

(Attorney Docket No. RECOPOl 1) entitled SYSTEM AND METHOD 

FOR DETECTING COMPUTER INTRUSIONS filed concurrently hercAvith, which is 
incorporated herein by reference for all purposes; and co-pending U.S. Patent Application 
No. (Attorney Docket No. RECOPOl 2) entitled EXTENSIBLE 

1 5 INTRUSION DETECTION SYSTEM filed concurrently herewith, which is incorporated 
herein by reference for all purposes; and co-pending U.S. Patent AppUcation No, 

(Attorney Docket No. RECOP014) entitled SYSTEM AND METHOD 

FOR USING SIGNATURES TO DETECT COMPUTER INTRUSIONS filed 
concurrently herewith, which is incorporated herein by reference for all purposes; and co- 

20 pending U.S. Patent Application No. (Attorney Docket No. RECOPOl 5) 

entitled SYSTEM AND METHOD FOR ANALYZING FILESYSTEMS TO DETECT 
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APPUCATION NUMBER 



FILING DATE 



FIRS3" NAMED APPLICANT 



ATTY. DOCKET NO/TITLE 



09/651,854 



21912 

RITTER VAN PELT & Yl, L.L.P. 
4906 EL CAMINO REAL 
SUITE 205 

LOS ALTOS. CA 94022 



08/30/2000 



Douglas B Moran 



RECOR013 



CONFiRMATION NO. 2198 

liilDiiiiiil 

OC000000006932882* 



Date Mailed: 10/18/2001 
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o 

RESPONSE TO REQUEST FOR CORRECTED FILING RECEIPTS ?i o 

5 ro m 

Claims, Fees, Inventors and Continuity fr^, ^ 

In response to your request for a corrected Filing Receipt, the Office is unable to connply with your reguest 
because: g 

n The total number of claims appearing on the Filing Receipt does not include multiple dependent 
claims. The total fee appearing on the Filing Receipt includes the cost of multiple dependent claims 
that were present at the time the application was filed. 

n The filing fee is correct. It includes the surcharge under 37 CFR 1 .16(e) for filing an oath/declaration or 
basic filing fee after the application filing date. 

n The inventor information may be truncated if the family name consists of more than 50 characters 
(letters and spaces combined) and if the given name consists of more than 50 characters (letters and 
spaces combined). The inventor's residence allows for up to 40 characters (letters and spaces 
combined). 



□ The docket number allows a maximum of 25 characters. 

jTj/ Continuity claimed under 35 USC 120 cannot be added to the Filing Receipt without supplying the 
relationship (i.e. continuation, divisional...). 

Q Foreign priority will appear on the Filing Receipt in the following order: 
Country, Application number, Filing date. 

Q The person signing on behalf of the deceased inventor will be reflected on your Filing Receipt as the 
legal representative. 
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Only one character per space is allowed. Therefore, punctuation which is usually placed above or 
below a letter, such as an umlaut (..). cannot be included on the Filing Receipt. 



Any corrections that may need to be done to your Filing Receipt should be directed to: 



Assistant Commissioner for Patents 
Office of Initial Patent Examination 
Customer Service Center 
Washington, DC 20231 



A copy of this notice MUST be returned with the reply. 




Customer Service Center 
Initial Patent Examination Division (703) 308-1202 
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Commissioner for Rwemts 
United States PATEhfr and "P^aoemark Office 

WkSHIMCTDN, D.C. 2023I 

www.uspto.gov 

I APPLICATION NUMBER | FILING DATE | GRPARTUNIT | RL FEE RECD |ATTY.D0CKET.N0| DRAWINGS | TOT CLAIMS | INDCLAIMS~| 

09/651,854 08/30/2000 2131 1152 RECOP013 11 24 6 



21912 

RITTER VAN PELT & Yl. L.L.P. 
4906 EL CAMINO REAL 
SUITE 205 

LOS ALTOS, OA 94022 



VAN PELT & Yl LLP 

SEP 2 4 2001 

RECEIVED. 



CONFIRMATION NO. 2198 
I LINP. REC EIPT 




•OC000000006S57308* 

SEP 2 4 2001 
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DOCKEXED.. 



: 09/14/2001 



1 



Receipt is acknowledged of this nonprovisional Patent Application. It will be considered in its order and you will be 
notified as to the results of the examination. Be sure to provide the U.S. APPLICATION NUMBER, FILING DATE, 
NAME OF APPLICANT, and TITLE OF INVENTION when inquiring about this application. Fees transmitted by 
check or draft are subject to collection. Please verify the accuracy of the data presented on this receipt. If an 
error is noted on this Filing Receipt, please write to the Office of Initial Patent Examination's Customer 
Service Center. Please provide a copy of this Filing Receipt with the changes noted thereon. If you 
received a "Notice to File Missing Parts" for this application, please submit any corrections to this Filing 
Receipt with your reply to the Notice. When the USPTO processes the reply to the Notice, the USPTO will 
generate another Filing Receipt incorporating the requested corrections (if appropriate). 



Douglas B Moran, Palo Alto. CA; 



Domestic Priority data as claimed by applicant 

THIS Al 

Foreign Applications 



THIS APPLN CLAIMS BENEFIT OF 60/151,531 08/30/1999 



If Required, Foreign Filing License Granted 10/26/2000 
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Projected Publication Date: N/A 
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Non-Publication Request: No 
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Early Publication Request: No 
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Title 



System and method for using login correlations to detect intrusions 



Preliminary Class 

713 
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